vboot.git
2 years agoDetect and report VM environment in crossystem master
Nicolas Norvez [Tue, 9 Aug 2016 10:42:08 +0000 (11:42 +0100)]
Detect and report VM environment in crossystem

Add "inside_vm" command to crossystem.
x86: If there is no HWID and mainfw_type is "nonchrome", report that the
host is a VM. If HWID is present, it's not a VM.
ARM: Detection not implemented and so far no ARM VMs exist, always
report that the system is not a VM

BUG=chromium:632303
TEST=emerge-cyan vboot_reference and test binary on cyan QEMU and HW
BRANCH=none

Change-Id: I18f5cb24b68e51f3097d9aafd9f0db0e610d322a
Reviewed-on: https://chromium-review.googlesource.com/367240
Commit-Ready: Nicolas Norvez <norvez@chromium.org>
Tested-by: Nicolas Norvez <norvez@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agofutility: Use vboot 2.0 APIs for private keys
Randall Spangler [Wed, 22 Jun 2016 23:46:23 +0000 (16:46 -0700)]
futility: Use vboot 2.0 APIs for private keys

This replaces calls to the vboot 1 host library with their vboot 2.0
equivalents.

BUG=chromium:611535
BRANCH=none
TEST=make runtests

Change-Id: Id061554fd82ea3efe35d0fe1485693b47599a863
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356540
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agofutility: Use only vboot 2.0 APIs for keyblocks
Randall Spangler [Tue, 21 Jun 2016 22:23:32 +0000 (15:23 -0700)]
futility: Use only vboot 2.0 APIs for keyblocks

This refactors futility and the host library to use only vboot 2.0 APIs
to create and verify keyblocks.

BUG=chromium:611535
BRANCH=none
TEST=make runtests

Change-Id: Ia3cc1e24971b94f01bcb4890c8666a3af6f84841
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356129
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agofutility: Create signatures using vboot 2.0 APIs
Randall Spangler [Fri, 17 Jun 2016 17:48:16 +0000 (10:48 -0700)]
futility: Create signatures using vboot 2.0 APIs

Refactor futility to use only vboot 2.0 APIs to create signatures.

BUG=chromium:611535
BRANCH=none
TEST=make runtests

Change-Id: I176e7f424fa556d34d8fe691df5681f1e43210ce
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356128
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agovboot: Always compile vb2.1 stuff into utillib
Randall Spangler [Fri, 17 Jun 2016 17:57:53 +0000 (10:57 -0700)]
vboot: Always compile vb2.1 stuff into utillib

Some of the vboot 2.0 and 2.1 functions call common code that currently
lives inside the vb2.1 host library.  To be able to use vboot 2.0 code
in futility, we always need to include the 2.1 sources.

BUG=chromium:611535
BRANCH=none
TEST=make runtests

Change-Id: Ib01622fa462d0bceda1e6041b5e3395ee7c2f94f
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356127
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agofutility: cmd_show uses only vboot 2.0 APIs
Randall Spangler [Fri, 3 Jun 2016 21:00:27 +0000 (14:00 -0700)]
futility: cmd_show uses only vboot 2.0 APIs

This removes the remaining vboot 1.0 API calls from cmd_show.

BUG=chromium:611535
BRANCH=none
TEST=make runtests

Change-Id: I03c4260aa034100efbbea1005367cd85dfff273d
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/350173
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agocgptlib: cast 32bit to 64bit before multiplication
Patrick Georgi [Tue, 2 Aug 2016 15:07:58 +0000 (17:07 +0200)]
cgptlib: cast 32bit to 64bit before multiplication

Coverity noted that multiplying two 32bit values happens in 32bit, while
the result is to be stored in an uint64_t.

BUG=none
BRANCH=none
TEST=none

Found-by: Coverity Scan #1353032, #1353033, 1353034
Change-Id: I8d0c5fe4feee066a81e8904c525dc836dd7a4fc6
Signed-off-by: Patrick Georgi <pgeorgi@google.com>
Reviewed-on: https://chromium-review.googlesource.com/365391
Commit-Ready: Patrick Georgi <pgeorgi@chromium.org>
Tested-by: Patrick Georgi <pgeorgi@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotlcl: implement clear, startup, shutdown, self test
Andrey Pronin [Tue, 26 Jul 2016 01:00:47 +0000 (18:00 -0700)]
tlcl: implement clear, startup, shutdown, self test

Implement TlclStartup, TlclSaveState, TlclResume, TlclSelfTestFull,
TlclContinueSelfTest, TlclForceClear.

BRANCH=none
BUG=chrome-os-partner:55210
BUG=chrome-os-partner:55250
TEST=boot on kevin in recovery mode, verify that 'tpmc ctest',
     'tpmc startup', 'tpmc clear' work.

Change-Id: I00839eae1984e24c0138ec5bdab8299379e1bcb6
Reviewed-on: https://chromium-review.googlesource.com/362996
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotlcl: support sending raw commands
Andrey Pronin [Mon, 25 Jul 2016 23:28:39 +0000 (16:28 -0700)]
tlcl: support sending raw commands

Implement TlclSendReceive and TlclPacketSize required
for sending raw commands.

BRANCH=none
BUG=chrome-os-partner:55210
TEST=boot on kevin, verify that 'tpmc raw' works

Change-Id: Iba41b95dd7790a6b7a3a7af6cf5f897f45dce1e5
Reviewed-on: https://chromium-review.googlesource.com/363033
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotpmc: define actions for all commands for tpm2
Andrey Pronin [Mon, 25 Jul 2016 18:58:03 +0000 (11:58 -0700)]
tpmc: define actions for all commands for tpm2

Implement macros to handle differences between TPM1.2 and TPM2.0.
For all original tpmc commands define if they are to
(1) be implemented, (2) do nothing, or (3) return a "not implemented"
error.
Print TPM mode (1.2 or 2.0) for tpmc in 'tpmc help' output.

BRANCH=none
BUG=chrome-os-partner:55210
BUG=chrome-os-partner:55250
TEST=boot on kevin; verify that the following tpmc commands do
     nothing and return success: ppon, enable, activate; verify
     that 'help' prnts the right mode and command descriptions.

Change-Id: Ifec4e8e5bd4afb45f76f9c2b3249c844ea1b670a
Reviewed-on: https://chromium-review.googlesource.com/363000
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agoModify 'tpmc block' to lock only the FW index
Andrey Pronin [Sat, 23 Jul 2016 01:45:37 +0000 (18:45 -0700)]
Modify 'tpmc block' to lock only the FW index

As discussed in https://chromium-review.googlesource.com/#/c/361381/,
instead of being a synonym to 'tpmc pplock', the 'tpmc block' command
should protect just the FW index using WriteLock.

Additionally, both TlclSetGlobalLock and TlclLockPhysicalPresence in
tlcl (which are used by 'tpmc block' and 'tpmc pplock') are updated
to first check if the platform hierarchy is already disabled and
return success, if so. That's needed to prevent command failures
when rollback protection is already on.

BRANCH=none
BUG=chrome-os-partner:55210
BUG=chrome-os-partner:55250
TEST=boot on kevin, verify that 'tpmc block' and 'tpmc pplock'
     work as expected:
     - pplock is possible after block
     - pplock and block succeed both for enabled and disabled PH
     - block locks FW index
     - pplock disables PH

Change-Id: I32bff2b590a51315b11da361b97c684dcce8ab36
Reviewed-on: https://chromium-review.googlesource.com/362772
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotlcl: automatically detect if platform hierarchy is disabled
Andrey Pronin [Sat, 23 Jul 2016 02:33:07 +0000 (19:33 -0700)]
tlcl: automatically detect if platform hierarchy is disabled

Instead of passing a special flag when 'tpmc' starts, auto-detect
if platform hierarchy is disabled in TlclLibInit(). See discussion
in https://chromium-review.googlesource.com/#/c/362520/.

BRANCH=none
BUG=chrome-os-partner:55210
BUG=chrome-os-partner:55250
TEST=boot on kevin, verify that 'tpmc read 0x1008 0xd' works

Change-Id: Id94e7faadf835f7ea58a944e914163d6849e85c1
Reviewed-on: https://chromium-review.googlesource.com/362771
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agovboot: Upgrade VerifyFirmwarePreamble() to vboot2.0
Randall Spangler [Thu, 2 Jun 2016 23:05:49 +0000 (16:05 -0700)]
vboot: Upgrade VerifyFirmwarePreamble() to vboot2.0

This replaces all calls to vboot1 VerifyFirmwarePreamble() with
equivalent vb2.0 functions.  No effect on ToT firmware, which already
uses the vboot2.0 functions.

BUG=chromium:611535
BRANCH=none
TEST=make runtests

Change-Id: I5c84e9ed0e0c75e2ea8dbd9bfcde0597bc457f24
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/349322
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agoapollolake: Find GPIO bank offset for write protect pin
sselvar2 [Thu, 9 Jun 2016 15:50:08 +0000 (21:20 +0530)]
apollolake: Find GPIO bank offset for write protect pin

Specify function to find GPIO bank offset for write protect pin in
Broxton.

BUG=chrome-os-partner:55604
BRANCH=none
TEST=verify crossystem output with and without WP screw.

Change-Id: Ied41f31e59e0dfc699fbcd1b6bb8688f1fea549c
Signed-off-by: sselvar2 <susendra.selvaraj@intel.com>
Reviewed-on: https://chromium-review.googlesource.com/358124
Commit-Ready: Aaron Durbin <adurbin@chromium.org>
Tested-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2 years agotlcl: tpm2: fix unmarshal_u32 return value
Andrey Pronin [Mon, 25 Jul 2016 22:15:04 +0000 (15:15 -0700)]
tlcl: tpm2: fix unmarshal_u32 return value

Before the fix, unmarshal_u32 returned only 16 bits of the value.

BRANCH=none
BUG=chrome-os-partner:55210
TEST=boot on keving, verify that 'tpmc getvf' correctly returns
     the 'orderly' flag (bit 31 of a 32-bit flags value)

Change-Id: I182abdd78a6bdcbc21fe631492559099caeb934f
Reviewed-on: https://chromium-review.googlesource.com/362994
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
2 years agoImplement GetCapabilities and reading flags for tpm2
Andrey Pronin [Sat, 23 Jul 2016 01:45:07 +0000 (18:45 -0700)]
Implement GetCapabilities and reading flags for tpm2

For TPM2.0:
1) Implement TPM2_GetCapabilities command that allows reading
TPM properties, including PERMANENT and STARTUP_CLEAR flags.
2) Implement 'getpf' and 'getvf' commands in tpmc.

BRANCH=none
BUG=chrome-os-partner:55210
BUG=chrome-os-partner:55250
TEST=boot on kevin, verify 'tpmc getpf' and 'tpmc getvf'

Change-Id: I8490b2c92ebf7c266e27b7cb5898126a1b99b1a8
Reviewed-on: https://chromium-review.googlesource.com/362770
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agovboot: Disambiguate vb2.1 structs and functions
Randall Spangler [Wed, 25 May 2016 23:42:44 +0000 (16:42 -0700)]
vboot: Disambiguate vb2.1 structs and functions

Futility needs to link against both vboot1/vboot2.0 and vboot2.1
functions.  This was easy in the past because it did (vboot1 +
vboot2.1) and there's no overlap.

In replacing vboot1 function calls and structs with vboot2.0, now there
are symbol collisions between vboot2.0 and vboot2.1.  For example, both
of them use a struct called vb2_signature, but the structs are defined
differently.  Functions which operate on those structs also overload.

Rename the vb2.1 structs to start with vb21_ instead of vb2_.  Do the
same for vb2.1 functions which operate on vb2.1 data.

BUG=chromium:611535
BRANCH=none
TEST=make runtests

Change-Id: I24defd87cbd9ef64239faf1a8e98ab2372d27539
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/347458
Reviewed-by: Daisuke Nojiri <dnojiri@google.com>
2 years agovboot: Remove vboot1 init and select-firmware APIs
Randall Spangler [Thu, 19 May 2016 16:36:46 +0000 (09:36 -0700)]
vboot: Remove vboot1 init and select-firmware APIs

And nuke all the underlying code that is unused once those APIs are
gone.  These APIs are not used by any project in ToT, having been
superseded last year by the vboot2 APIs.

No functional changes to live code, just lots of deletes.

CQ-DEPEND=CL:347414

BUG=chromium:611535
BRANCH=none
TEST=make runtests; build samus

Change-Id: I05ac752d74d1343dd03600b1c5e6ed22822e2802
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/347257

2 years agobmpblk_utility: fix build warnings (errors) with USE="-minimal"
Brian Norris [Fri, 22 Jul 2016 17:17:56 +0000 (10:17 -0700)]
bmpblk_utility: fix build warnings (errors) with USE="-minimal"

Warning like this:

utility/bmpblk_utility.cc: In member function 'void vboot_reference::BmpBlockUtil::load_yaml_config(const char*)':
utility/bmpblk_utility.cc:104:61: error: format '%ld' expects argument of type 'long int', but argument 2 has type 'std::vector<std::basic_string<char> >::size_type {aka unsigned int}' [-Werror=format=]
       printf("%ld image_names\n", config_.image_names.size());
                                                             ^
utility/bmpblk_utility.cc:108:59: error: format '%ld' expects argument of type 'long int', but argument 2 has type 'std::map<std::basic_string<char>, vboot_reference::ImageConfig>::size_type {aka unsigned int}' [-Werror=format=]
       printf("%ld images_map\n", config_.images_map.size());
                                                           ^
utility/bmpblk_utility.cc:119:61: error: format '%ld' expects argument of type 'long int', but argument 2 has type 'std::map<std::basic_string<char>, vboot_reference::ScreenConfig>::size_type {aka unsigned int}' [-Werror=format=]
       printf("%ld screens_map\n", config_.screens_map.size());
                                                             ^
utility/bmpblk_utility.cc: In member function 'void vboot_reference::BmpBlockUtil::pack_bmpblock()':
utility/bmpblk_utility.cc:597:70: error: format '%ld' expects argument of type 'long int', but argument 3 has type 'std::basic_string<char>::size_type {aka unsigned int}' [-Werror=format=]
                current_offset, it->second.compressed_content.length());
                                                                      ^
utility/bmpblk_utility.cc:609:59: error: format '%ld' expects argument of type 'long int', but argument 3 has type 'std::basic_string<char>::size_type {aka unsigned int}' [-Werror=format=]
                current_offset, config_.locale_names.size());
                                                           ^

Technically, C++ container::size_type is slightly different than size_t, but I
think %zd should work fine.

BRANCH=none
BUG=none
TEST=`USE="-minimal" emerge-kevin vboot_reference`

Change-Id: I9d0b22818714cad2ad7e95557df7837c91c2b0f7
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/362621
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agoFix yaml pkg-config warnings
Brian Norris [Fri, 22 Jul 2016 17:11:09 +0000 (10:11 -0700)]
Fix yaml pkg-config warnings

I see warnings like this when building with USE=minimal (the default):

Package yaml-0.1 was not found in the pkg-config search path.
Perhaps you should add the directory containing `yaml-0.1.pc'
to the PKG_CONFIG_PATH environment variable
No package 'yaml-0.1' found

That's because we don't have a yaml dependency for the USE=minimal
build, yet we still unconditionally call `pkg-config --libs yaml-0.1`.

Let's move the pkg-config calls into 'ifeq' block where they're actually
used.

BRANCH=none
BUG=none
TEST=`emerge-${BOARD} vboot_reference` both with and without USE=minimal

Change-Id: I96a59848ee970abacbe4cc3c56bb35c7cf552f63
Signed-off-by: Brian Norris <briannorris@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/362620
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agovboot: Convert vboot1 SHA calls to use vboot2
Randall Spangler [Wed, 11 May 2016 20:50:18 +0000 (13:50 -0700)]
vboot: Convert vboot1 SHA calls to use vboot2

This change replaces all calls to the old vboot1 SHA library with their
vboot2 equivalents.

This is the first in a long series of changes to move the core vboot kernel
verification into vb2, and the control/display loop out to depthcharge.

BUG=chromium:611535
BRANCH=none
TEST=make runtests; build samus firmware and boot it

Change-Id: I31986eb766176c0e39a192c5ce15730471c3cf94
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/344342
Tested-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agovboot: Fix potential alignment issue reading FWMP
Randall Spangler [Thu, 21 Jul 2016 22:33:31 +0000 (15:33 -0700)]
vboot: Fix potential alignment issue reading FWMP

RollbackFwmpRead() assumed that a uint8[] array on the stack would be
aligned sufficiently for typecasting to struct RollbackSpaceFwmp and
accessing its members.

This was true on x86 (where unaligned accesses work fine) and probably
harmless on other platforms (since RollbackSpaceFwmp is
__attribute__(packed).  But it's cleaner to switch to using a union of
the buffer and struct, since that will provide the proper alignment.

BUG=chromium:601492
BRANCH=baytrail and newer platforms
TEST=make -j runtests

Change-Id: I97077923ab5809c68510cbd382541bf2827aba6b
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/362087
Commit-Ready: Dan Shi <dshi@google.com>
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
2 years agotlcl: use different NV_Read authorizations for fw and userland
Andrey Pronin [Mon, 18 Jul 2016 18:24:55 +0000 (11:24 -0700)]
tlcl: use different NV_Read authorizations for fw and userland

Let's use an earlier version of CL 360944 that relies on the
global flag to decide if the platform authorization is to
be used.

As it turned out, we can't read NVRAM with empty
password authorization if platform hierarchy is still enabled
(as it is in firmware), so we keep platform authorization for
firmware, and use empty password only for userland utilities,
like tpmc.

BRANCH=none
BUG=chrome-os-partner:55531
TEST=Run 'initctl stop trunksd; tpmc read 0x1008 0xd" on
     kevin, verify that it returns the right output.

Change-Id: Ic878ebde9086e803d2487d90c55c0f19001cf94b
Signed-off-by: Andrey Pronin <apronin@google.com>
Reviewed-on: https://chromium-review.googlesource.com/362520
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>

2 years agoSupport 'tpmc setbgloballock' for tpm2 case
Andrey Pronin [Mon, 18 Jul 2016 18:23:12 +0000 (11:23 -0700)]
Support 'tpmc setbgloballock' for tpm2 case

Some scripts call 'tpmc setbgloballock' or 'tpmc block'. For tpm2
it should be equivalent to pplock, i.e. perform rollback protection
actions: writelock for NVRAM firmware index and disable platform
hierarchy.

BRANCH=none
BUG=chrome-os-partner:55210
TEST=run 'tpmc block' on kevin, check that it attempts pplock

Change-Id: I51fae6bd111cf3ff3c1dfbed7441868abad8fc15
Reviewed-on: https://chromium-review.googlesource.com/361381
Commit-Ready: Dan Shi <dshi@google.com>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Darren Krahn <dkrahn@chromium.org>
2 years agoRead NVRAM with proper authorization for tpm2
Andrey Pronin [Tue, 19 Jul 2016 20:41:11 +0000 (13:41 -0700)]
Read NVRAM with proper authorization for tpm2

In TPM2 case, NVRAM must be read with empty password
authorization in tpmc, since platform hierarchy is
disabled by firmware or trunksd for rollback prevention.

Since all NVRAM indices are now defined with
AUTHREAD, switch to empty password authorization from
platform authorization for all NVRAM reads in Tlcl.

BRANCH=none
BUG=chrome-os-partner:55210
BUG=chrome-os-partner:55251
TEST=Run 'initctl stop trunksd; tpmc read 0x1008 0xd" on
     kevin, verify that it returns the right output.

Change-Id: Ifb72ff5080a4ac5f8d63b5c0713e5bb184f176ca
Reviewed-on: https://chromium-review.googlesource.com/360944
Commit-Ready: Dan Shi <dshi@google.com>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
2 years agoProper armv7l host arch detection
Paul Kocialkowski [Tue, 12 Jul 2016 20:24:16 +0000 (22:24 +0200)]
Proper armv7l host arch detection

This allows properly detecting an armv7l host architecture and setting
the right ARCH value so that e.g. crossystem can build fine.

BRANCH=none
BUG=none
TEST=Build host_stuff on an armv7l machine

Change-Id: I6a6ac74477eff41e73eca671d9dac229888c4e77
Signed-off-by: Paul Kocialkowski <contact@paulk.fr>
Reviewed-on: https://chromium-review.googlesource.com/360160
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
2 years agoStub tlcl implementation for tpm2 case
Andrey Pronin [Thu, 7 Jul 2016 02:10:46 +0000 (19:10 -0700)]
Stub tlcl implementation for tpm2 case

Build a special version of TPM Lightweight Command Library in
libvboot_host for TPM2. Create the framework for implementation, stub
functions for now. libvboot_host is used by tpmc and other user-space
utilities that talk directly to tpm bypassing trunks/trousers.

BRANCH=none
BUG=chrome-os-partner:54981
BUG=chrome-os-partner:55210
TEST=Boot on kevin, verify that 'tpmc read' works.

Change-Id: I4cc41028041193041defc319687697eb9edb1f3e
Reviewed-on: https://chromium-review.googlesource.com/358623
Commit-Ready: Andrey Pronin <apronin@chromium.org>
Tested-by: Stephen Barber <smbarber@chromium.org>
Tested-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2 years agobdb: Add nvmrw_get and nvmrw_set
Daisuke Nojiri [Tue, 28 Jun 2016 21:50:16 +0000 (14:50 -0700)]
bdb: Add nvmrw_get and nvmrw_set

These internal APIs are used to get and set values in NVM-RW variables.

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: Ibae1836cb569fe89dd2c8249f76c66b78b1c2cf4
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356691
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotpm2: add nvram lock and hierarchy control commands
Vadim Bendebury [Wed, 6 Jul 2016 16:07:54 +0000 (09:07 -0700)]
tpm2: add nvram lock and hierarchy control commands

The firmware needs to lock the kernel rollback index before starting
up the kernel. The TPM2_NV_WriteLock command is used for that.

We also want to limit the amount of control the user space apps have
over TPM. With TPM1.2 it was achieved by deasserting physical
presence. TPM2 specification allows to achieve the same goal by
disabling Platform Hierarchy, which is active out of reset.

BRANCH=none
BUG=chrome-os-partner:50465
TEST=verified that all commands succeed and chrome OS boots up fine.

Change-Id: Ia5893460e0b29f1945cb2aae45a5f10b08fe1ed1
Reviewed-on: https://chromium-review.googlesource.com/358351
Commit-Ready: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-by: Darren Krahn <dkrahn@chromium.org>
2 years agofix a compile flag typo
Vadim Bendebury [Wed, 6 Jul 2016 20:46:02 +0000 (13:46 -0700)]
fix a compile flag typo

The code guarded by this compilation flag is not supposed to kick in
on gru/kevin, this is how the typo went unnoticed.

BRANCH=none
BUG=none
TEST=kevin still boots into chrome os

Change-Id: Ic12aacb7ad9b2361666e719a50597d3836d5212a
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/358493
Reviewed-by: Julius Werner <jwerner@chromium.org>
2 years agovb2api: pad digest buffers if they are larger than digest sizes
Vadim Bendebury [Wed, 6 Jul 2016 16:01:05 +0000 (09:01 -0700)]
vb2api: pad digest buffers if they are larger than digest sizes

Extending tpm PCRs in case of TPM2 requires 32 bit values, some
digests pre-calculated in vboot source code are 20 bytes in size. To
make sure that PCR extension is consistent, pad remaining buffer space
when a 20 byte digest is returned in a 32 byte buffer.

BRANCH=none
BUG=chrome-os-partner:50645
TEST=did not verify much, made sure that PCR extension commands
     triggered by coreboot succeed.

Change-Id: Ib16bdf782f18a6106eadb4b880cd1e67b56ad6db
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/358175
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotpm2: refactor tpm2 return value processing
Vadim Bendebury [Wed, 6 Jul 2016 15:55:12 +0000 (08:55 -0700)]
tpm2: refactor tpm2 return value processing

There is no point in checking and reporting error code in each
function calling tpm_process_command(), let's do it in one place for
all commands.

BRANCH=none
BUG=chrome-os-partner:50645
TEST=Kevin still boots to chrome os

Change-Id: I10f45bd15df293f63401c295c5dce833543c50da
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/358174
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Darren Krahn <dkrahn@chromium.org>
2 years agotpm2: add marshaling/unmarshaling and tlcl support
Vadim Bendebury [Tue, 28 Jun 2016 17:27:16 +0000 (10:27 -0700)]
tpm2: add marshaling/unmarshaling and tlcl support

The marshaling code is a port of the coreboot patch
https://chromium-review.googlesource.com/353915. The only supported
commands at this time are NV_read and NV_write.

The tlcl layer includes functions necessary to satisfy compilation
requirements of rollback_index.c, functions to lock spaces and clear
TPM are not yet implemented, they just report being invoked.

The missing functions implementation is coming, but even without it it
is possible to boot Chrome OS with firmware and kernel rollback
counters maintained in the TPM NVRAM.

BRANCH=none
BUG=chrome-os-partner:50645
TEST=with depthcharge patches applied kevin/gru boards boot into
     chrome OS with rollback counters read from/written to TPM2

Change-Id: I29fe9069d7c37c33d354f36c93bda15d439bf74f
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356753
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotpm2: simplify rollback checks.
Vadim Bendebury [Tue, 28 Jun 2016 17:15:11 +0000 (10:15 -0700)]
tpm2: simplify rollback checks.

On the systems using TPM2 this rollback index check will run only for
the kernel space. This means that TPM initialization is guaranteed to
be completed by the time this code runs.

The exact ways of verifying the space settings and locking it are
still being designed, this functionality is temporarily excluded in
this patch.

BRANCH=none
BUG=chrome-os-partner:50645
TEST=with the rest of the patches applied kevin/gru boards boot into
     chrome OS with rollback counters read from/written to TPM2

Change-Id: Ie4e22886493404f538b2b3ae6f8c2bdca5f7ab22
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356752
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotpm: add TSS constants and structures for TPM2
Vadim Bendebury [Tue, 28 Jun 2016 16:43:37 +0000 (09:43 -0700)]
tpm: add TSS constants and structures for TPM2

The latest TPM specification uses different command codes, command
structures and return codes.

Let's put definitions for different TPM versions into different
include files.

CQ-DEPEND=CL:357831
BRANCH=none
BUG=chrome-os-partner:50645
TEST=with the rest of the patches applied kevin/gru boards boot into
     chrome OS with rollback counters read from/written to TPM2

Change-Id: Ie13696d4e5098a4ea5e338e84334d257e5c704a7
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356751
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agoAdd ability to build vboot firmware for TPM2 support
Vadim Bendebury [Tue, 28 Jun 2016 16:46:14 +0000 (09:46 -0700)]
Add ability to build vboot firmware for TPM2 support

TPM2 will have to use a different tlcl layer, the configuration option
will be provided by depthcharge at build time.

BRANCH=none
BUG=chrome-os-partner:50645
TEST=with the rest of the patches applied kevin/gru boards boot into
     chrome OS with rollback counters read from/written to TPM2

Change-Id: I0694741f5317da2c3268ee9edfdf29caff2fc26c
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/356750
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agobdb: Add secrets library
Daisuke Nojiri [Fri, 6 May 2016 19:32:38 +0000 (12:32 -0700)]
bdb: Add secrets library

The secrets library clears, extends, and derives secrets which are used
by vboot SoC.

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: I38c93fd450364792cebc942694f848e10d0e9502
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/349252
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agobdb: Add vba_update_buc
Daisuke Nojiri [Fri, 6 May 2016 19:32:38 +0000 (12:32 -0700)]
bdb: Add vba_update_buc

vba_update_buc writes a BUC (boot unlock code) to NVM-RW. It will be called
by AP-RW to update a BUC.

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: Ic91f34b60b11ebce948bce01993ddb44519a59b8
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/346233

2 years agotest: Add tests for futility show and vbutil_*
Randall Spangler [Fri, 3 Jun 2016 19:09:00 +0000 (12:09 -0700)]
test: Add tests for futility show and vbutil_*

Currently, the unit tests verify a 0 exit code, but don't check the
output.  Add tests to check the output.

BUG=chromium:617247
BRANCH=none
TEST=make runtests

Change-Id: I842046bb6f788eee05a1f2f511c6fb08df4a5379
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/349670
Reviewed-by: Daisuke Nojiri <dnojiri@google.com>
2 years agovboot_api_kernel: Remove assumptions about EC-RW hash type and size
Julius Werner [Fri, 27 May 2016 20:27:18 +0000 (13:27 -0700)]
vboot_api_kernel: Remove assumptions about EC-RW hash type and size

With newer PD chips and different update mechanisms, we can no longer
guarantee that the "hash" (really just a sort of version identifier) of
an EC-RW image will always be a SHA256. This patch removes any hardcoded
assumptions about that from vboot, and instead accepts any hash size
returned by VbExEcHashImage() and VbExEcGetExpectedImageHash().

It also removes the assumption that the hash can be regenerated by
running SHA256 over the full image returned by VbExEcGetExpectedImage().
We can thus no longer support VBERROR_EC_GET_EXPECTED_HASH_FROM_IMAGE,
which is fine since that functionality hasn't been needed for years and
there would be no reason why we might need it in the future. This also
allows simplifying the code flow of EcUpdateImage() a bit (since you can
really just return very early if you already figured out that you don't
need to update).

BRANCH=None
BUG=chrome-os-partner:53780
TEST=Tested software sync on Oak both after cold and warm boot.

Change-Id: I498f3d39085a38740734fff9f2d1a186a0801489
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/348001
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agovb2_sha: Add sha256 extend
Daisuke Nojiri [Fri, 20 May 2016 02:09:10 +0000 (19:09 -0700)]
vb2_sha: Add sha256 extend

This patch adds vb2_sha256_extend, which extends a hash using a given block.

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: I512674f18dffc55692907c85b19ff19df88a5eeb
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/346234
Commit-Ready: Daisuke Nojiri <dnojiri@google.com>
Tested-by: Daisuke Nojiri <dnojiri@google.com>
Reviewed-by: Randall Spangler <rspangler@google.com>
2 years agobdb: Add NVM library
Daisuke Nojiri [Fri, 6 May 2016 19:32:38 +0000 (12:32 -0700)]
bdb: Add NVM library

This patch adds NVM library, which verifies, updates, and syncs NVM-RW of
vboot SoC.

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: I5adc399f9e582bd9ea7d9ee73482ed9a924837e0
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/343121
Reviewed-by: Daisuke Nojiri <dnojiri@google.com>
2 years agotest: Print out actual result when test_succ fails
Daisuke Nojiri [Wed, 18 May 2016 17:24:59 +0000 (10:24 -0700)]
test: Print out actual result when test_succ fails

BUG=none
BRANCH=tot
TEST=make runtests

Change-Id: I419b01d2dd0798bd0a3fe155e41d6aa3d328716a
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/345586
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agotest: Make TEST_* report test location
Daisuke Nojiri [Fri, 6 May 2016 21:38:06 +0000 (14:38 -0700)]
test: Make TEST_* report test location

This patch converts TEST_* functions to macros, which print file name
and line # of the check. This will allow us to locate a failed test
quickly.

New TEST_* macros also automatically generate a test name if
testname == NULL. This will save us time to think of a name for
every single check we write in a test.

BUG=none
BRANCH=tot
TEST=make runtests

Change-Id: Ibdeb99681985c3f348836d256fa3484f2f0c315f
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/343233
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agohmac: Add HMAC to 2lib library
Daisuke Nojiri [Fri, 6 May 2016 00:21:29 +0000 (17:21 -0700)]
hmac: Add HMAC to 2lib library

This patch adds HMAC. HMAC will be used to sign/verify NVM structures.
Hash algorithms can be selected from those supported
by enum vb2_hash_algorithm (i.e. SHA1, SHA256, or SHA512).

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: I6d349bc807874fe2a5512aabcd7fbf67a4eaa40a
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342880
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agovboot: Fix FWMP link error if TPM is mocked
Randall Spangler [Tue, 10 May 2016 16:45:05 +0000 (09:45 -0700)]
vboot: Fix FWMP link error if TPM is mocked

The MOCK_TPM build flag caused link to fail because RollbackFwmpRead()
was missing its mock.

BUG=chromium:601492
BRANCH=baytrail and newer platforms
TEST=make -j runtests
     Hack makefile to add MOCK_TPM := 1 and make -j; no link errors.

Change-Id: I3885d6b6c627bf475f4da33ef67f31aec2159799
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/343920
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
2 years agovboot: Add firmware management parameters
Randall Spangler [Fri, 15 Apr 2016 21:49:40 +0000 (14:49 -0700)]
vboot: Add firmware management parameters

This adds RW firmware support for the optional firmware management
parameters TPM space.

System-level tests require CL:339262 to add cryptohome support.

BUG=chromium:601492
BRANCH=baytrail and newer platforms
TEST=make -j runtests
     Or better, COV=1 make, and then make sure all new code is covered.

Change-Id: Ifaf644c80809552d5961615be6017c2a332a034b
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/339234

2 years agotest: Add TEST_STR_NEQ
Daisuke Nojiri [Fri, 6 May 2016 20:53:32 +0000 (13:53 -0700)]
test: Add TEST_STR_NEQ

TEST_STR_NES can be used to check the returned string is not what it
shouldn't be.

BUG=none
BRANCH=tot
TEST=make runtests

Change-Id: I09d5a63334e9b8365a44bb96ed31db8155d95e21
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/343120
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agobdb: Add vba_bdb_init
Daisuke Nojiri [Wed, 4 May 2016 21:55:57 +0000 (14:55 -0700)]
bdb: Add vba_bdb_init

vba_bdb_init initializes the vboot context and decides what to do next
based on the vboot register content. Possible actions are:
1. proceed to verify the current slot
2. reset to try the other slot
3. reset to recovery mode

bdb_sprw_test demonstrates these actions.

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: If72cdd575d09b9162a871f088064ca853b7fd74d
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342604
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agobdb: Add vboot_register.h
Daisuke Nojiri [Tue, 3 May 2016 23:46:55 +0000 (16:46 -0700)]
bdb: Add vboot_register.h

vboot_register.h lists definitions for vboot registers. Vboot registers
are used to transfer information between modules (coreboot & depthcharge)
or boots.

BUG=chrome-os-partner:51907
BRANCH=tot
TEST=make runtests

Change-Id: Ie0876fefb43d3e79a8f96e8f25f99f798892a056
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342603

2 years agobdb: Rename subkey to datakey
Daisuke Nojiri [Tue, 3 May 2016 23:46:55 +0000 (16:46 -0700)]
bdb: Rename subkey to datakey

This patch replaces subkey with datakey to make name use consistent
with the design document.

BUG=chrome-os-partner:51908
BRANCH=tot
TEST=make runtests

Change-Id: I3690abd51e6c18c5a1094a8449f375d803c7e0b2
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342199
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agobdb: Replace sha functions with vb2 library
Daisuke Nojiri [Tue, 3 May 2016 23:23:53 +0000 (16:23 -0700)]
bdb: Replace sha functions with vb2 library

BDB has its own implementation of SHA256. This patch replaces it with
the one implemented in vb2 library.

BUG=chrome-os-partner:51908
BRANCH=tot
TEST=build runtests

Change-Id: Ida19dd49153a038fc2b2ce481cedf828818aaeaa
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342121
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agobdb: Integrate bdb_test
Daisuke Nojiri [Tue, 3 May 2016 20:24:10 +0000 (13:24 -0700)]
bdb: Integrate bdb_test

This patch integrate bdb_test with the root Makefile.

BUG=chrome-os-partner:51908
BRANCH=tot
TEST=make runtests

Change-Id: I6266199d8f3068d2e9349110e8351f20d027ab35
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342091
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agobdb: Copy files from bdb to firmware/bdb
Daisuke Nojiri [Tue, 3 May 2016 16:29:16 +0000 (09:29 -0700)]
bdb: Copy files from bdb to firmware/bdb

Test files are copied to tests/ and the rest are copied to firmware/bdb/.

BUG=chrome-os-partner:51908
BRANCH=tot
TEST=make runtests

Change-Id: I19f66c398e69037f00812a789854340a9690fef5
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/342090
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agoRevert "image_signing: use sparse partition extraction [reland]"
Amey Deshpande [Wed, 27 Apr 2016 07:30:54 +0000 (00:30 -0700)]
Revert "image_signing: use sparse partition extraction [reland]"

This reverts commit f482470b72086d5ba672513434f3da5d62599538.

The original change is the suspected root cause of chromium:606738.

TEST=signing_unittests.py in cros-signing passes (with updated
vboot_stable_hash).
BUG=chromium:606738
BRANCH=None

Change-Id: I21ea027bbda123ee26c6deb4437b07d2fc6e8575
Reviewed-on: https://chromium-review.googlesource.com/340895
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Amey Deshpande <ameyd@google.com>
2 years agocgpt: Add cgpt legacy parameter to set primary GPT signature to IGNOREME
Julius Werner [Wed, 20 Apr 2016 20:05:53 +0000 (13:05 -0700)]
cgpt: Add cgpt legacy parameter to set primary GPT signature to IGNOREME

Now that we have support for the IGNOREME signature in cgpt, we need a
way to set it on an existing disk. The easiest option is to shoehorn
this into the cgpt legacy command, because that's already made to modify
GPT header signatures (really, it would be nice to rename it to cgpt
signature or something, but let's not break existing uses for now).

BRANCH=None
BUG=chrome-os-partner:52595
TEST=unit tests

Change-Id: If2835fec28a9c39373abd050e2e057f73e5ec700
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340073
Reviewed-by: Nam Nguyen <namnguyen@google.com>
2 years agocgptlib: Add support for IGNOREME GPT signature
Julius Werner [Tue, 19 Apr 2016 23:55:36 +0000 (16:55 -0700)]
cgptlib: Add support for IGNOREME GPT signature

This patch makes cgpt aware of a special "IGNOREME" GPT header signature
string that may appear in either the primary or the secondary GPT and
cause cgpt (and other cgptlib clients) to completely ignore that GPT. It
will continue to function correctly for all other purposes (using the
data from the non-ignored GPT), but never write any data back to the
ignored GPT.

BRANCH=None
BUG=chrome-os-partner:52595
TEST=unit tests

Change-Id: I7e53542385ae9d8d24dc25b75e91f4ff4917f66f
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340072
Reviewed-by: Nam Nguyen <namnguyen@google.com>
2 years agocgpt: Fully write out primary GPT before starting to write secondary
Julius Werner [Tue, 19 Apr 2016 20:20:52 +0000 (13:20 -0700)]
cgpt: Fully write out primary GPT before starting to write secondary

The point of having two GPTs is to always have a known good one if one
of them gets corrupted. One of the most obvious ways that could happen
is if the write stopped half-way through (e.g. due to a crash or random
power loss).

Unfortunately, the way we currently save modified GPTs can leave both
copies invalid if we stop writing at just the wrong time. Since a GPT
header contains a checksum over the GPT entries, we need to write both
the header and entries for one GPT (and make sure they're synced to
disk) before we start writing the other.

BRANCH=None
BUG=chrome-os-partner:52595
TEST=None

Change-Id: I2d4b56bcfba9a94395af5896f274ebade9e39081
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340071
Reviewed-by: Nam Nguyen <namnguyen@google.com>
2 years agovboot: Save last screen ID
Daisuke Nojiri [Thu, 21 Apr 2016 21:54:45 +0000 (14:54 -0700)]
vboot: Save last screen ID

This patch makes VbDisplayScreen remember the last successfully displayed
screen and skip rendering if the same screen is requested.

When locale is changed, VbCheckDisplayKey calls VbDisplayScreen with force=1,
which makes VbDisplayScreen render the requested screen regardless of the
saved screen ID.

BUG=chromium:602793
BRANCH=tot
TEST=emerge-veyron_jerry vboot_reference chromeos-bootimage

Change-Id: I31c4dde4ff060081f14224a93d57e9b76fcac1db
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/340264
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
2 years agosign_official_build: retain /boot for EFI devices
Amey Deshpande [Tue, 29 Mar 2016 21:31:54 +0000 (14:31 -0700)]
sign_official_build: retain /boot for EFI devices

TEST=Ran sign_official_build locally on image w/ cros_efi and checked
the signed image had /boot in rootfs.
BUG=chromium:604967
BRANCH=None

Change-Id: Id6e1a6409e07fa37a5c116c66ac937dd9aec1481
Reviewed-on: https://chromium-review.googlesource.com/335469
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Don Garrett <dgarrett@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
2 years agoinclude sys/sysmacros.h for major()
Mike Frysinger [Tue, 19 Apr 2016 17:58:49 +0000 (13:58 -0400)]
include sys/sysmacros.h for major()

The major() func is defined in the sys/sysmacros.h header, so include it
explicitly for the prototype.  Upstream C libs are moving away from having
sys/types.h include it all the time implicitly.

BUG=None
TEST=precq passes
BRANCH=None

Change-Id: I56b84138f08ded2376193403f9c9db22c5f24f71
Reviewed-on: https://chromium-review.googlesource.com/339680
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@google.com>
2 years agoSupport doing battery cut-off in firmware stage.
Hung-Te Lin [Thu, 7 Apr 2016 04:21:03 +0000 (12:21 +0800)]
Support doing battery cut-off in firmware stage.

Add a new crossystem value "battery_cutoff_request" to indicate that
next reboot should cut-off battery and shutdown during firmware stage.

This request is primarily for factories to ship devices in an safe
state. Previously we have done same thing by running "ectool battery-cutoff"
but that creates a problem which "ectool" (and the one to request for
cut-off) must live in developer mode while  the device must be shipped
in normal mode. The mode transition was solved by setting
"disable_dev_request=1", but that flag is may get lost on x86 systems
(having NV storage in CMOS) when the battery is cut-off .

From the experience from Ryu, such settings (dev mode transition and
battery cut-off) should be done together inside firmware execution so we
can create a new flag, battery_cutoff_request, to finalize device
properly.

BRANCH=none
BUG=chromium:601705
TEST=emerge-chell depthcharge vboot_reference chromeos-bootimage
     crossystem battery_cutoff_request=1
     # Unplug AC adapter
     reboot
     # See device rebooted and then shutdown immediately.
     # Press power button and system won't boot.
     # Attach AC adapter and now system boots.
CQ-DEPEND=CL:337596,CL:338193

Change-Id: I73ccae15b337cd65786106646546c67c155b8fa6
Reviewed-on: https://chromium-review.googlesource.com/337602
Commit-Ready: Hung-Te Lin <hungte@chromium.org>
Tested-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
2 years agocrossystem: x86: Write VbNv with mosys if using vboot2
Duncan Laurie [Wed, 30 Mar 2016 16:38:54 +0000 (09:38 -0700)]
crossystem: x86: Write VbNv with mosys if using vboot2

If this is an x86 system using vboot2 then write VbNv data
to CMOS and also use mosys to write it directly to flash.

BUG=chrome-os-partner:51846
BRANCH=none
TEST=emerge-chell vboot_reference; emerge-oak vboot_reference
verify on chell that "crossystem dev_disable_request=1" is
written to both CMOS and flash.

Change-Id: Ifd5dcee4d401f8de36801c5c0a7db3255e618e28
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/336311
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2 years agocrossystem: Move mosys based VbNv functions to shared code
Duncan Laurie [Wed, 30 Mar 2016 16:35:20 +0000 (09:35 -0700)]
crossystem: Move mosys based VbNv functions to shared code

The code to read/write vbnv with mosys was implemented in the
ARM specific code so move it to the generic crosystem code
so it can be used on x86.

No functional changes in this commit.

BUG=chrome-os-partner:51846
BRANCH=none
TEST=emerge-chell vboot_reference; emerge-oak vboot_reference

Change-Id: I3fe18fadb924094e710427208976328caf12a009
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/336310
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2 years agocgpt: Update behavior of GptUpdateKernelWithEntry
Furquan Shaikh [Fri, 2 Oct 2015 02:22:31 +0000 (19:22 -0700)]
cgpt: Update behavior of GptUpdateKernelWithEntry

In order to support slots, we need to update behavior of
GptUpdateKernelWithEntry so that:
1. Invalid - Marks kernel entry as invalid
2. Active - Marks kernel entry as active

CQ-DEPEND=CL:336906
BUG=chrome-os-partner:51807
BRANCH=None
TEST=Compiles successfully "sudo emerge vboot_reference" "emerge-smaug
vboot_reference". "make -j runtests" successful.

Change-Id: If248b3c6bdd23d03cb1dd24f4e21cacef5cc3f26
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/335942
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2 years agoimage_signing: use sparse partition extraction [reland]
Mike Frysinger [Thu, 10 Sep 2015 20:18:03 +0000 (16:18 -0400)]
image_signing: use sparse partition extraction [reland]

Often the partitions we extract have extra space in them, but the dd
utility will still write out the excess zeros.  That can mean we write
out hundreds of megs of data which could otherwise be skipped.  We thus
waste a good amount of I/O and storage.

For now, only use this flag when extracting a partition to a new file
as this should be safe (there's no pre-existing data to clobber/merge).

Now that the signers have been upgraded to Trusty, we can land this.

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: I275973ebfc028c15a8d1ef33dd9b3dcf6ca726a2
Reviewed-on: https://chromium-review.googlesource.com/306420
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Amey Deshpande <ameyd@google.com>
2 years agosigner: improve error handling in update_legacy_bootloader()
Amey Deshpande [Tue, 8 Mar 2016 20:05:53 +0000 (12:05 -0800)]
signer: improve error handling in update_legacy_bootloader()

BRANCH=None
BUG=chromium:590933
TEST=Ran sign_official_build.sh locally and booted the image on kvm
(using BIOS).

$ ./sign_official_build.sh base chromiumos_base_image.bin \
  ../../tests/devkeys chromiumos_base_image_signed.bin

Change-Id: I2e1aad6e2073dea8e92d6ee25ac6972a5d555d71
Reviewed-on: https://chromium-review.googlesource.com/331661
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
2 years agovb2: Modify phase2 behavior for S3 resume case
Duncan Laurie [Sat, 20 Feb 2016 04:20:10 +0000 (20:20 -0800)]
vb2: Modify phase2 behavior for S3 resume case

If a platform does verification of memory init then it must be careful
to use the same slot for resume that it booted from.  This is
accomplished by adding a context flag to indicate this is an S3 resume
and that vboot should treat it differently than a normal boot.

When this flag is set then the same slot that was booted is read from
VBNV and re-used for the resume path, without adjusting any try flags.
If this slot is B then the related context flag is set.

This will allow the firmware updater to update the other (non-booted)
slot and set flags indicating that on the next boot the updated slot
should be tried, while still allowing suspend/resume to work with the
existing firmware slot.

This assumes that the last tried slot was successfully booted, which
should be a safe assumption since the system was able to boot and then
suspend.  It isn't reliable to check last_fw_result for "success"
status because that status is only set some time after boot when
chromeos-setgoodkernel calls chromeos-firmwareupdate --mode=bootok
and so it may still report a status of "trying" on resume depending
on how soon after boot the suspend happened.

It also avoids setting the vboot flag indicating that a slot choice
was made in order to avoid altering the try counter on failure since
this is explicitly not attempting to boot the new slot.

BUG=chromium:577269
BRANCH=glados
TEST=manually tested on chell:
1) ensure that booting from slot A resumes from slot A.
2) ensure that booting from slot B resumes from slot B.
3) do RW update while booted from slot A (so the flags are set to try
slot B) and ensure that suspend/resume still functions properly using
current slot A.
4) do RW update while booted from slot B (so the flags are set to try
slot A) and ensure that suspend/resume still functions properly using
current slot B.

Change-Id: I500faef2b5d19a02f32839976354abf6d551c9f6
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/328812
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2 years agosign_nv_cbootimage: Update signing scripts for nv bootloader and lp0
Furquan Shaikh [Wed, 13 Jan 2016 22:49:03 +0000 (14:49 -0800)]
sign_nv_cbootimage: Update signing scripts for nv bootloader and lp0

Currently, nvidia tools do not provide the support to perform signing
of bootloader or lp0 image. Thus, the signing script is updated to
support this. Once, we have the required tools, this script can be
simplified again.

CQ-DEPEND=CL:*244234
BUG=chrome-os-partner:43018
BRANCH=none
TEST=Verified that signed bootloader and lp0 work fine on dev-PKC
fused devices.

Reference:
https://code.google.com/p/chrome-os-partner/issues/attachmentText?id=43018&aid=430180067000&name=sign-lp0.sh&token=ABZ6GAcjz4b2mEk55WqREzwTnWWpEyE_7A%3A1452631308268
https://code.google.com/p/chrome-os-partner/issues/attachmentText?id=43018&aid=430180060000&name=sign.sh&token=ABZ6GAcRky67XrzMOgKZfkJxr70qm-tTAg%3A1452631308240

Change-Id: Icb024a1d9a61714df6e52d94c96cf43481cac869
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/321459
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
2 years agovboot_display: Keep track of displayed screen stable
Duncan Laurie [Fri, 29 Jan 2016 17:45:51 +0000 (09:45 -0800)]
vboot_display: Keep track of displayed screen

Vboot needs to track the currently displayed screen so when it needs to
change the locale or display the debug overlay it knows which screen to
redraw.  Currently only the legacy path is doing this so change the new
path to update the current screen if it is successfully drawn.

BUG=chrome-os-partner:49766
BRANCH=glados
TEST=boot on glados in dev mode, hit tab and ensure screen does not go black

Change-Id: I4a2bf028275db57b2d0469fc1cb574e871820713
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/324549
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2 years agovb20: add vb2api_check_hash_get_digest() for retrieving hash result
Aaron Durbin [Fri, 22 Jan 2016 21:06:05 +0000 (15:06 -0600)]
vb20: add vb2api_check_hash_get_digest() for retrieving hash result

For x86 systems, which resume through the boot reset vector, to
implement vboot verification of the memory init code one needs
check that the slot chosen on the resume path is the same as
the original boot path. That check is done by storing the
resulting hash of the slot. However, vb2api doesn't export
the resulting hash from vb2api_check_hash(). Thus, provide
a variant which saves the resulting digest in the supplied
buffer.

BUG=chrome-os-partner:46049
BRANCH=glados
TEST=Suspended and resumed on chell. Also, tested with an EC build
     which returns a bad hash to ensure that is properly caught.

Change-Id: Ic20be2024afedabc2d8bc767f1b794376348523c
Signed-off-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/323460
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
2 years agoPipe the custom_music use flag to the define
Alexandru M Stan [Tue, 12 Jan 2016 19:45:29 +0000 (11:45 -0800)]
Pipe the custom_music use flag to the define

This will allow the definition of CUSTOM_MUSIC from
the individual board ebuilds.

TEST=Define use flag and extra functions on a board, enjoy the custom tunes
BUG=chrome-os-partner:48657
BRANCH=master

Change-Id: I974f9cc51f9b25fb3dff063926e6ea01cf1e031b
Signed-off-by: Alexandru M Stan <amstan@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/323833
Commit-Ready: Alexandru Stan <amstan@chromium.org>
Tested-by: Alexandru Stan <amstan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
2 years agoIncrease MAX_CUSTOM_DELAY to 5 minutes
Alexandru M Stan [Fri, 18 Dec 2015 23:28:32 +0000 (15:28 -0800)]
Increase MAX_CUSTOM_DELAY to 5 minutes

Rialto will soon need a longer dev mode delay, this variable would prevent it.

BUG=chrome-os-partner:48657
TEST=See follow up CLs
BRANCH=master

Change-Id: Ie5ada9c5441b5b042bd0801d66559ab715fbbf47
Signed-off-by: Alexandru M Stan <amstan@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/323832
Commit-Ready: Alexandru Stan <amstan@chromium.org>
Tested-by: Alexandru Stan <amstan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
2 years agovboot: Disable VBNV_OPROM_NEEDED after successful update
Duncan Laurie [Wed, 20 Jan 2016 20:53:15 +0000 (12:53 -0800)]
vboot: Disable VBNV_OPROM_NEEDED after successful update

The VBOOT_OPROM_NEEDED flag is used for EC software sync when the
VBSD_EC_SLOW_UPDATE flag is set.

After a successful EC software sync vboot requests a reboot to disable
graphics but it is not clearing the VBNV flag first.  With vboot1 this
was getting cleared as a side effect of calling VbInit in normal mode.

BUG=chrome-os-partner:49560
BRANCH=glados
TEST=Enable EC_SLOW_UPDATE on chell and test EC software sync in normal
mode and ensure that it reboots and does not do graphics init if the
update is successful.

Change-Id: I2aa0c4c3b1ad357a5b8ddc14539e264a1f5b76b2
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/322731
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
2 years agoModify EC software sync to update RO if necessary
Mary Ruthven [Wed, 6 Jan 2016 19:30:55 +0000 (11:30 -0800)]
Modify EC software sync to update RO if necessary

Allow the AP to sync and verify the EC read only image after updating
the rewritable image.

BUG=chrome-os-partner:48703
BRANCH=none
TEST=manual

1. Update EC to a new version
2. rebuild EC code
3. Update AP firmware
4. Reboot and check that the RO image is updated after the RW image is
updated.

CQ-DEPEND=CL:319213

Change-Id: I774ef25320103f20d8c7d1c180a220dd0819c04d
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/320614
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agoUpdate a utility to support the new tpm sysfs class directory
Bryan Freed [Thu, 7 Jan 2016 17:11:58 +0000 (09:11 -0800)]
Update a utility to support the new tpm sysfs class directory

Kernel TPM patches from 4.x moved /sys/class/misc/tpm0 to /sys/class/tpm/tpm0.
Support both paths in this utility.

BUG=chromium:573368
BRANCH=none
TEST=untested, not sure if this utility is still used.

Change-Id: Ib81476eee4c9de921502a3a47f6990b9e6b1968b
Reviewed-on: https://chromium-review.googlesource.com/320892
Commit-Ready: Bryan Freed <bfreed@chromium.org>
Tested-by: Bryan Freed <bfreed@chromium.org>
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
2 years agoPort to musl: musl doesn't have execinfo.h.
Doug Evans [Thu, 19 Nov 2015 23:57:23 +0000 (15:57 -0800)]
Port to musl: musl doesn't have execinfo.h.

Change-Id: Idc2f18880581d3a2e67185becee8b77cfa5cdf04
Reviewed-on: https://chromium-review.googlesource.com/313388
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agovboot: Change VbExEc implementations to support RO update
Mary Ruthven [Fri, 18 Dec 2015 19:16:02 +0000 (11:16 -0800)]
vboot: Change VbExEc implementations to support RO update

This change will be used to support EC-RO software sync by allowing for
access to the readonly region of firmware. Currently only the writable
section is accessed by vboot using VB_SELECT_FIRMWARE_A and B.

BUG=chrome-os-partner:48703
BRANCH=none
TEST=built on jerry and check that the RO hash can be read and the image
can be updated.
CQ-DEPEND=CL:319185,CL:320425,CL:320598

Change-Id: Ic3942d86b65da3123798cfd11a78056f5dab6699
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/319213
Reviewed-by: Randall Spangler <rspangler@chromium.org>
2 years agoInclude <fcntl.h> instead of <sys/fcntl.h>.
Doug Evans [Thu, 19 Nov 2015 23:05:45 +0000 (15:05 -0800)]
Include <fcntl.h> instead of <sys/fcntl.h>.

Musl complains about using sys/fcntl.h, and with -Werror that
gives a compilation failure. Every other file includes <fcntl.h>
so just use that.

Change-Id: Ibc743bbe335e9e9b91da7e4eacc01cc80cd8b35a
Reviewed-on: https://chromium-review.googlesource.com/313419
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Nam Nguyen <namnguyen@chromium.org>
2 years agoUse ${WERROR} consistently.
Doug Evans [Thu, 19 Nov 2015 22:58:25 +0000 (14:58 -0800)]
Use ${WERROR} consistently.

Change-Id: I37b414b030cc69fab2b4feec70b55297dcd5fdb7
Reviewed-on: https://chromium-review.googlesource.com/313198
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
2 years agovboot2: Add try RO software sync flag
Mary Ruthven [Tue, 5 Jan 2016 22:59:05 +0000 (14:59 -0800)]
vboot2: Add try RO software sync flag

This flag will be used by the firmware updater to indicate that RO
software sync should be attempted.

BUG=chrome-os-partner:48703
BRANCH=None
TEST=make runtests

Change-Id: I42090ac47da45c724e66334648ab447ad3c21178
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/320621
Reviewed-by: Randall Spangler <rspangler@chromium.org>
3 years agoMove default target up so it's really the default.
Doug Evans [Thu, 19 Nov 2015 22:14:18 +0000 (14:14 -0800)]
Move default target up so it's really the default.

The line
${FUTIL_BIN}: ${UTILLIB21}
was changing the default.

Change-Id: I7988af498c9a9a1981cf2485e4f9d3496412f133
Reviewed-on: https://chromium-review.googlesource.com/313245
Commit-Ready: Bill Richardson <wfrichar@chromium.org>
Tested-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
3 years agoTest sha-256 with multiple odd-length updates
Randall Spangler [Tue, 15 Dec 2015 19:39:21 +0000 (11:39 -0800)]
Test sha-256 with multiple odd-length updates

This verifies that the VB2 sha-256 library can handle odd-length
updates.

The expected digest  was generated from:
  echo -n 'test1test2test3' | sha256sum

BUG=None
BRANCH=None
TEST=make runtests

Change-Id: Ia7d57322a1a4b10e718c47f1dae38ed244cf8ebc
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/318363
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
3 years agoAdd BDB library
Randall Spangler [Thu, 10 Dec 2015 23:03:22 +0000 (15:03 -0800)]
Add BDB library

This is a standalone library for verifying the BDB structures in the
common boot flow document, and a bdb_create utility to create test BDB
structures.  Eventually, creating these structures will be rolled into
futility.

BUG=chrome-os-partner:48448
BRANCH=none
TEST=cd bdb && make runtests

Change-Id: Ic57c26ca84137205da3b6c7d532f5324c93b4285
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/317275
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
3 years agoadd error code for screen drawing failure
Daisuke Nojiri [Wed, 2 Dec 2015 20:05:41 +0000 (12:05 -0800)]
add error code for screen drawing failure

This patch adds error code for screen drawing failure.

BUG=none
BRANCH=tot
TEST=Tested on Glados

Change-Id: I04b349fd2c0bc539338b7ee27b8fa9544c85c873
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/315257
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
3 years agoFix error message for VbGbbReadBmpHeader
Daisuke Nojiri [Wed, 18 Nov 2015 01:44:46 +0000 (17:44 -0800)]
Fix error message for VbGbbReadBmpHeader

BUG=none
BRANCH=tot
TEST=Tested on Jerry

Change-Id: I1ecfd28b4c694e4aa531ed0e77219b2160509bd0
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/313744
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
3 years agosign_official_build: add a fallback key for standalone accessories
Vincent Palatin [Tue, 17 Nov 2015 19:18:19 +0000 (11:18 -0800)]
sign_official_build: add a fallback key for standalone accessories

The standalone accessories are using a key name like this:
key_<product>.pem or key_<product>.vbprik2
when it doesn't exist, fallback using key.pem or key.vbprik2.

BRANCH=none
BUG=chrome-os-partner:47557
TEST=manual:
./scripts/image_signing/sign_official_build.sh accessory_usbpd ../ec/build/zinger/ec.bin tests/devkeys-acc /tmp/ec-zinger.TEST.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin tests/devkeys-acc /tmp/ec-hadoken.TEST.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin /tmp /tmp/ec-hadoken.TEST.SIGNED.bin

Change-Id: I68863664bdb9da1695e91b1986f3a0148af7da26
Reviewed-on: https://chromium-review.googlesource.com/312836
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
3 years agoGive more screen control to vboot_draw_screen
Daisuke Nojiri [Mon, 16 Nov 2015 19:47:28 +0000 (11:47 -0800)]
Give more screen control to vboot_draw_screen

New devices have Depthcharge render vboot screens by calling
vboot_draw_screen. Thus, display initialization and backlight control should
not be duplicated. This patch prevents VbDisplayScreen from initializing
display and controlling backlight when vboot is rendering screens using GBB.

BUG=chrome-os-partner:43706,chromium:502066
BRANCH=tot
TEST=Tested on Glados

Change-Id: I50cd2decb7065af96779601b12f0fbf2554ff6ed
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/312749
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
3 years agocrossystem: Remove savedmem_base and savedmem_size fields
Julius Werner [Fri, 6 Nov 2015 22:28:44 +0000 (14:28 -0800)]
crossystem: Remove savedmem_base and savedmem_size fields

I don't even know what this is. It seems to have marked some kind of
debug buffer provided by H2C BIOS on pre-Daisy Chromebooks and has not
been touched since it was copied in here when crossystem was first
added. I can't find any references in our codebase so I doubt anybody
would miss it. Let's remove it so the '(error)' fields returned there on
any modern Chromebook stop confusing our vendors.

BRANCH=None
BUG=chromium:551715
TEST=Built for Falco and Jerry.

Change-Id: Ie2baec536b50bb192eb4cd3e48df212cce53561a
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/311346
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
3 years agocrossystem: Remove platform_family field
Julius Werner [Fri, 6 Nov 2015 22:22:32 +0000 (14:22 -0800)]
crossystem: Remove platform_family field

This field doesn't seem to be used for anyone and it keeps adding work
for people trying to bring up new platforms. If we ever needed something
like this again, we'd probably prefer to have it in mosys now anyway.
Let's get rid of it.

BRANCH=None
BUG=chromium:551715
TEST=Built for Falco and Jerry.

Change-Id: I6b96e255968fdd22a345d4a75bfdc1e79d3f5896
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/311345
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
3 years agoUpdate accessories test keys location
Vincent Palatin [Fri, 30 Oct 2015 23:34:37 +0000 (16:34 -0700)]
Update accessories test keys location

Move around the test keys used for standalone accessories signing
unittesting, so they are easier to use.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=run cros-signing unittests (./signing_unittests.py)

Change-Id: I02fcf444ec76bf6ebf6eb477e1236869aa877210
Reviewed-on: https://chromium-review.googlesource.com/309967
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
3 years agovboot: Add GBB flag to turn on serial output
Mary Ruthven [Wed, 28 Oct 2015 17:48:59 +0000 (10:48 -0700)]
vboot: Add GBB flag to turn on serial output

Currently this does nothing. This will eventually be used to enable
serial output.

BUG=chromium:210230
BRANCH=none
TEST=none

Change-Id: I5c25fd7406e30b96d12bc4bf8210d3c3f4ae79f1
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/309716
Reviewed-by: Randall Spangler <rspangler@chromium.org>
3 years agovboot_api_kernel: Add new EcVbootDone API
Shawn Nematbakhsh [Wed, 21 Oct 2015 21:31:02 +0000 (14:31 -0700)]
vboot_api_kernel: Add new EcVbootDone API

Add a new post-EC software sync API VbExEcVbootDone() to take actions
which normally need to happen after EC verification / sysjump.

BUG=chromium:537269
TEST=Manual on Glados. Set CHG_MW thresh to 20000, BAT_PCT to 50. Verify
that LIMIT_POWER host event is set until Zinger negotiates to 20V. Also
verify that we do not proceed with boot when Donette is plugged.
BRANCH=None
CQ-DEPEND=CL:307885,CL:309523

Change-Id: I77e6000aa8a44e3aca4fb5982e5b5f5191774989
Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/307952
Commit-Ready: Shawn N <shawnn@chromium.org>
Tested-by: Shawn N <shawnn@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
3 years agosign_official_build: fix support for signing standalone accessories
Vincent Palatin [Wed, 28 Oct 2015 16:21:43 +0000 (09:21 -0700)]
sign_official_build: fix support for signing standalone accessories

My previous patch using futility to re-sign standalone accessory
firmware images had a mistake in the key directory path : fix it.

Also add RSA-2048 'accessory' keys for signer unit testing.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=run cros-signing unittests (./signing_unittests.py)

Change-Id: Ia2f641c85337c67f81968be4730643a6ad5f22cf
Reviewed-on: https://chromium-review.googlesource.com/309530
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
3 years agoVbVerifyMemoryBootImage: Allow integrity-only check in dev mode with
Furquan Shaikh [Wed, 28 Oct 2015 20:01:27 +0000 (13:01 -0700)]
VbVerifyMemoryBootImage: Allow integrity-only check in dev mode with
FASTBOOT_FULL_CAP set

This change allows developers to boot dev-signed boot images in
unlocked mode if DEV_BOOT_FASTBOOT_FULL_CAP is set in VbNvStorage or
GBB_FLAG_FORCE_DEV_BOOT_FASTBOOT_FULL_CAP is set.

BUG=chrome-os-partner:47002
BRANCH=None
TEST=Compiles successfully. make -j runtests

Change-Id: I56e3879594da1b57051dfe242ff347ac970c96bb
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/309606
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
3 years agosign_official_build: add support for signing standalone accessories
Vincent Palatin [Tue, 20 Oct 2015 00:22:07 +0000 (17:22 -0700)]
sign_official_build: add support for signing standalone accessories

Use futility to re-sign standalone accessory firmware images either the
former "usbpd1" used by USB Power Delivery firmware generated from the
EC codebase or the new "rwsig" format.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=manual:
openssl genrsa -F4 -out key_zinger.pem 2048
openssl genrsa -F4 -out key_hadoken.pem 2048
futility create --desc="Hadoken fake MP key" key_hadoken.pem key_hadoken
./scripts/image_signing/sign_official_build.sh accessory_usbpd build/zinger/ec.bin . build/zinger/ec.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig build/hadoken/keyboard_app.bin . build/hadoken/keyboard_app.SIGNED.bin
and compare the re-signed files with the original files.

Change-Id: I586ba3e4349929782e734af1590f394824e7dd44
Reviewed-on: https://chromium-review.googlesource.com/306795
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
3 years agoSave recovery reason before user three-finger-salutes
Daisuke Nojiri [Wed, 21 Oct 2015 01:31:10 +0000 (18:31 -0700)]
Save recovery reason before user three-finger-salutes

When a user hits esc+refresh+power to start recovery, the true recovery
reason will be lost after reboot. (It would always look like
VB2_RECOVERY_RO_MANUAL.) This patch makes VbBootRecovery save
the reason in the subcode area before entering the new 'broken' loop.

BUG=chromium:501060
BRANCH=tot
TEST=test_that -b veyron_jerry suite:faft_bios

Change-Id: Ib536daa0633721bfc975381782d348f122b3d337
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/307586
Reviewed-by: Randall Spangler <rspangler@chromium.org>
3 years agoAdd VbExGetLocalizationCount
Daisuke Nojiri [Wed, 7 Oct 2015 00:03:08 +0000 (17:03 -0700)]
Add VbExGetLocalizationCount

VbExGetLocalizationCount is a callback function which is supposed to
return the number of screen locales supported by VbExDisplayScreen.

After this change, we still try to get the number of locales from GBB
first but when it fails, VbExGetLocalizationCount is called. The error
code from VbGbbReadBmpHeader will be masked, similarly to the error from
VbDislayScreenFromGBB.

BUG=chromium:502066
BRANCH=tot
TEST=Tested on Samus. make runtests

Change-Id: I04ef8bf1ea02b1aaa05e65673b57bcea1932d8b0
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/304376
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
3 years agofutility: add support for .pem with public key
Vincent Palatin [Fri, 16 Oct 2015 00:54:34 +0000 (17:54 -0700)]
futility: add support for .pem with public key

Add support for PEM file containing a RSA Public key in futility "show"
and "create" commands.

When "futility create" is given a PEM file with only a RSA public key,
generate the proper .vbpubk2 rather than failing.

BRANCH=smaug
BUG=none
TEST=make runtests
and run manually
futility show tests/testkeys/key_rsa4096.pub.pem
futility show tests/testkeys/key_rsa4096.pem

Change-Id: I707ceca54c80ba21f53869ad86c86fa23b31e665
Reviewed-on: https://chromium-review.googlesource.com/306683
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
3 years agofutility: fix segfault on short files
Vincent Palatin [Fri, 16 Oct 2015 00:46:58 +0000 (17:46 -0700)]
futility: fix segfault on short files

Verify the size of the buffer read from the file before trying to use 1KB of
it for the new rwsig format detection.

Add a new test case with a short file containing only 4 bytes of unknown
data and run "futility show" on it.

BRANCH=smaug
BUG=none
TEST=futility show foobar.pub.pem
where foobar.pub.pem is a 451-byte file.
check that "make runtests" passes with the fix
and fails without it with the following message :
test_file_types.sh ... failed
FAIL: 13 / 14 passed

Change-Id: Ia9d68c6b528c2b3a595ea6791c907374616d051f
Reviewed-on: https://chromium-review.googlesource.com/306682
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>